0

I have master and slave machines and wish to be able to passwordless ssh between root accounts.

On slave I did sudo su - root and passwd to set up a root password.

On slave I edited /etc/ssh/sshd_config and added PermitRootLogin yes

Doing this allowed me to do the following on master:

ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa_root
cat ~/.ssh/id_rsa_root.pub >> ~/.ssh/authorized_keys
sudo chmod 600 ~/.ssh/id_rsa_root
sudo chmod 600 ~/.ssh/id_rsa_root.pub
ssh-copy-id -i $HOME/.ssh/id_rsa_root.pub  root@slave

But when I now try ssh root@slave it always asks for a password and then allows login.

I have tried on slave editing /etc/ssh/sshd_config and changing PermitRootLogin yesto PermitRootLogin without-password but then ssh root@slave gives Permission denied.

Tearing my hair out, any help is much appreciated!

PS: I'm running ubuntu 16.04 and I login to root on master to do connect to slave using sudo su - root but I did the stuff on slave as a different user (maybe that makes a difference?)

EDIT: I've added the output of ssh -v root@slave2 might help?

root@master:~# ssh -v root@slave2
OpenSSH_7.2p2 Ubuntu-4ubuntu1, OpenSSL 1.0.2g-fips  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug1: Connecting to slave2 [192.168.1.2] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu1
debug1: Remote protocol version 2.0, remote software version
OpenSSH_7.2p2 Ubuntu-4ubuntu1
debug1: match: OpenSSH_7.2p2 Ubuntu-4ubuntu1 pat OpenSSH* compat 
x04000000
debug1: Authenticating to slave2:22 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ecdsa-sha2-nistp256 
HA256:D8gzBgBFRg1AnBsKfrY/fVGzIXDPtA+86TZa3e7Ylms
debug1: Host 'slave2' is known and matches the ECDSA host key.
debug1: Found key in /root/.ssh/known_hosts:1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<rsa-sha2-256,rsa-sha2-512>
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /root/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password
debug1: Trying private key: /root/.ssh/id_dsa
debug1: Trying private key: /root/.ssh/id_ecdsa
debug1: Trying private key: /root/.ssh/id_ed25519
debug1: Next authentication method: password
  • Since you've used a non-standard name for the key file (id_rsa_root instead of plain id_rsa) you will probably need to give it explicitly on the ssh command line i.e. ssh -i ~/.ssh/id_rsa_root root@slave. As a side note, if you are doing passwordless ssh you should not need to set root's password and you should use PermitRootLogin without-password rather than PermitRootLogin yes. – steeldriver Jul 1 '16 at 12:44
  • That was it! Thank you so much!! Do you want to answer it and I'll accept it? – user1773592 Jul 1 '16 at 13:33
1

Since you've used a non-standard name for the key file (id_rsa_root instead of plain id_rsa) you will need to give it explicitly on the ssh command line i.e.

ssh -i ~/.ssh/id_rsa_root root@slave

Alternatively, you could set up a ~/.ssh/config file containing an entry for slave with the appropriate IdentityFile entry. See man ssh_config for details.


As a side note, if you are doing passwordless ssh you should not need to set root's login password (although not doing so initially means you will need to manually copy the public key to root's authorized_keys file, using sudo, since you won't be able to use ssh-copy-id) and you should use PermitRootLogin without-password rather than PermitRootLogin yes in the remote system's /etc/ssh/sshd_config file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.